Helpy Io
Monthly
Stored cross-site scripting in Helpy 2.8.0's knowledge base Doc rendering logic allows authenticated admin or agent editor accounts to persist arbitrary JavaScript in Doc body fields, which then executes silently in the browsers of any user who views the affected page. The vulnerability is confirmed in version 2.8.0 per CPE cpe:2.3:a:helpy.io:helpy:2.8.0 and the Fluid Attacks advisory (EUVD-2026-26245). No active exploitation has been identified - EPSS sits at 0.04% (13th percentile) and CISA KEV lists no known threat actor activity - but the stored nature of the payload means a single injection persists for all subsequent victims without further attacker interaction.
Stored cross-site scripting in Helpy 2.8.0 allows any registered user to persist arbitrary HTML in their account display name, which renders unescaped across three distinct surfaces: public forum threads, the admin ticket view, and HTML notification emails sent to other users. The multi-surface persistence is the key risk amplifier - a single malicious account name can target both end-users and privileged administrators without further action by the attacker. No active exploitation is confirmed (SSVC: none; EPSS: 0.05%), making this a medium-priority issue requiring a registered attacker account and victim interaction.
Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in Helpy 2.8.0's knowledge base Doc rendering logic allows authenticated admin or agent editor accounts to persist arbitrary JavaScript in Doc body fields, which then executes silently in the browsers of any user who views the affected page. The vulnerability is confirmed in version 2.8.0 per CPE cpe:2.3:a:helpy.io:helpy:2.8.0 and the Fluid Attacks advisory (EUVD-2026-26245). No active exploitation has been identified - EPSS sits at 0.04% (13th percentile) and CISA KEV lists no known threat actor activity - but the stored nature of the payload means a single injection persists for all subsequent victims without further attacker interaction.
Stored cross-site scripting in Helpy 2.8.0 allows any registered user to persist arbitrary HTML in their account display name, which renders unescaped across three distinct surfaces: public forum threads, the admin ticket view, and HTML notification emails sent to other users. The multi-surface persistence is the key risk amplifier - a single malicious account name can target both end-users and privileged administrators without further action by the attacker. No active exploitation is confirmed (SSVC: none; EPSS: 0.05%), making this a medium-priority issue requiring a registered attacker account and victim interaction.
Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.